{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T10:48:16Z","timestamp":1772448496570,"version":"3.50.1"},"reference-count":37,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2021,8,21]],"date-time":"2021-08-21T00:00:00Z","timestamp":1629504000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,8,21]],"date-time":"2021-08-21T00:00:00Z","timestamp":1629504000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Comput Virol Hack Tech"],"published-print":{"date-parts":[[2022,6]]},"DOI":"10.1007\/s11416-021-00396-w","type":"journal-article","created":{"date-parts":[[2021,8,21]],"date-time":"2021-08-21T09:02:55Z","timestamp":1629536575000},"page":"117-126","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Covert timing channels: analyzing WEB traffic"],"prefix":"10.1007","volume":"18","author":[{"given":"Mehrdad","family":"Nasseralfoghara","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6346-3318","authenticated-orcid":false,"given":"Hamid Reza","family":"Hamidi","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2021,8,21]]},"reference":[{"issue":"4","key":"396_CR1","doi-asserted-by":"publisher","first-page":"148","DOI":"10.3390\/info10040148","volume":"10","author":"F Sommer","year":"2019","unstructured":"Sommer, F., J\u00fcrgen, D., Reiner, K.: Survey and classification of automotive security attacks. Information 10(4), 148 (2019). https:\/\/doi.org\/10.3390\/info10040148","journal-title":"Information"},{"issue":"1","key":"396_CR2","doi-asserted-by":"publisher","first-page":"517","DOI":"10.1109\/COMST.2017.2748278","volume":"20","author":"F Mikhail","year":"2018","unstructured":"Mikhail, F., Flor, A., Steinmetzer, D., Paul Gardner, S., Hollick, M.: Survey and systematization of secure device pairing. Commun. Surv. Tutor. IEEE 20(1), 517\u2013550 (2018). https:\/\/doi.org\/10.1109\/COMST.2017.2748278","journal-title":"Commun. Surv. Tutor. IEEE"},{"key":"396_CR3","doi-asserted-by":"publisher","unstructured":"US Department of Defense.: Trusted Computer System Evaluation Criteria. ISBN 978-0-333-53947-7, Palgrave Macmillan, London (1985). https:\/\/doi.org\/10.1007\/978-1-349-12020-8_1.","DOI":"10.1007\/978-1-349-12020-8_1"},{"key":"396_CR4","unstructured":"Gligor,V.D.: A guide to understanding covert channel analysis of trusted systems. National Computer Security Center (US). Meade, Maryland, NCSC-TG-030 (1994)"},{"key":"396_CR5","doi-asserted-by":"publisher","unstructured":"Carrara, B., Adams, C.: A survey and taxonomy aimed at the detection and measurement of covert channels. In: Proceedings of the 4th ACM Workshop on Information Hiding and Multimedia Security, pp. 115\u2013126 (2016). https:\/\/doi.org\/10.1145\/2909827.2930800","DOI":"10.1145\/2909827.2930800"},{"key":"396_CR6","doi-asserted-by":"publisher","unstructured":"Okhravi, H., Bak, S., King, S.T.: Design, implementation and evaluation of covert channel attacks. In: IEEE International Conference on Technologies for Homeland Security (HST), pp. 481\u2013487 (2010). https:\/\/doi.org\/10.1109\/THS.2010.5654967","DOI":"10.1109\/THS.2010.5654967"},{"key":"396_CR7","doi-asserted-by":"publisher","unstructured":"Wang, Z., Lee, R.B.: New constructive approach to covert channel modeling and channel capacity estimation. In: International Conference on Information Security, pp. 498\u2013505 (2005). https:\/\/doi.org\/10.1007\/11556992_37","DOI":"10.1007\/11556992_37"},{"issue":"3","key":"396_CR8","doi-asserted-by":"publisher","first-page":"273","DOI":"10.1007\/s11432-007-0037-2","volume":"50","author":"S Changxiang","year":"2007","unstructured":"Changxiang, S., et al.: Survey of information security. Sci. China Ser. F Inf. Sci. 50(3), 273\u2013298 (2007). https:\/\/doi.org\/10.1007\/s11432-007-0037-2","journal-title":"Sci. China Ser. F Inf. Sci."},{"key":"396_CR9","doi-asserted-by":"publisher","first-page":"9292","DOI":"10.1109\/ACCESS.2018.2802783","volume":"6","author":"Z Xiaosong","year":"2018","unstructured":"Xiaosong, Z., et al.: A covert channel over volte via adjusting silence periods. IEEE Access 6, 9292\u20139302 (2018). https:\/\/doi.org\/10.1109\/ACCESS.2018.2802783","journal-title":"IEEE Access"},{"key":"396_CR10","doi-asserted-by":"publisher","unstructured":"Mazurczyk, W. et al.: Information Hiding in Communication Networks: Fundamentals, Mechanisms, Applications, and Countermeasures, Wiley (2016). https:\/\/doi.org\/10.1002\/9781119081715","DOI":"10.1002\/9781119081715"},{"key":"396_CR11","doi-asserted-by":"publisher","unstructured":"Cabuk, S., Brodley, C.E., Shields, C.: IP covert timing channels: design and detection. In: Proceedings of the 11th ACM Conference on Computer and Communications Security, pp. 178\u2013187 (2004). https:\/\/doi.org\/10.1145\/1030083.1030108","DOI":"10.1145\/1030083.1030108"},{"key":"396_CR12","unstructured":"Berk, V., Giani, A., Cybenko, G., Hanover, N.: Detection of covert channel encoding in network packet delays. Rapport technique TR536, de lUniversit\u00e9 de Dartmouth, p. 19 (2005)"},{"key":"396_CR13","doi-asserted-by":"publisher","unstructured":"Coleman, T.P., Kiyavash, N.: Sparse graph codes and practical decoding algorithms for communicating over packet timings in networks. In: 42nd Annual Conference on Information Sciences and Systems, CISS 2008, pp. 447\u2013452 (2008). https:\/\/doi.org\/10.1109\/CISS.2008.4558568","DOI":"10.1109\/CISS.2008.4558568"},{"key":"396_CR14","doi-asserted-by":"publisher","first-page":"83","DOI":"10.1016\/j.jnca.2017.10.019","volume":"101","author":"S Yao","year":"2018","unstructured":"Yao, S., Yang, W., Liusheng, H.: Concealed in web surfing: behavior-based covert channels in HTTP. J. Netw. Comput. Appl. 101, 83\u201395 (2018). https:\/\/doi.org\/10.1016\/j.jnca.2017.10.019","journal-title":"J. Netw. Comput. Appl."},{"key":"396_CR15","unstructured":"Chen, A. et al.: Detecting covert timing channels with time-deterministic replay. In: 11th {USENIX} Symposium on Operating Systems Design and Implementation ({OSDI} 14) (2014)"},{"issue":"5","key":"396_CR16","first-page":"13","volume":"2","author":"B Beyrami","year":"2014","unstructured":"Beyrami, B., Dehghani, M., Saleh Esfahani, M.: Covert timing channel detection based on statistical methods. J. Electron. Cyber Defence 2(5), 13\u201324 (2014). ((in Persian))","journal-title":"J. Electron. Cyber Defence"},{"key":"396_CR17","doi-asserted-by":"publisher","unstructured":"Kiyavash, N., Coleman, T.: Covert timing channels codes for communication over interactive traffic. In: ICASSP IEEE International Conference on Acoustics, Speech and Signal processing, pp. 1485\u20131488 (2009). https:\/\/doi.org\/10.1109\/ICASSP.2009.4959876","DOI":"10.1109\/ICASSP.2009.4959876"},{"issue":"4","key":"396_CR18","doi-asserted-by":"publisher","first-page":"22","DOI":"10.1145\/1513601.1513604","volume":"12","author":"S Cabuk","year":"2009","unstructured":"Cabuk, S., Brodley, C.E., Shields, C.: IP covert channel detection. ACM Trans. Inf. Syst. Secur. (TISSEC) 12(4), 22 (2009). https:\/\/doi.org\/10.1145\/1513601.1513604","journal-title":"ACM Trans. Inf. Syst. Secur. (TISSEC)"},{"issue":"3","key":"396_CR19","first-page":"13","volume":"8","author":"M Nasseralfoghara","year":"2021","unstructured":"Nasseralfoghara, M., Hamidi, H.: Web covert timing channel detection based on entropy. Electron. Cyber Defense 8(3), 13\u201323 (2021). (in Persian)","journal-title":"Electron. Cyber Defense"},{"issue":"4","key":"396_CR20","doi-asserted-by":"publisher","first-page":"255","DOI":"10.3233\/JHS-200642","volume":"26","author":"M Nasseralfoghara","year":"2020","unstructured":"Nasseralfoghara, M., Hamidi, H.: Entropy-based analyzing anomaly WEB traffic. High Speed Netw. 26(4), 255\u2013266 (2020)","journal-title":"High Speed Netw."},{"key":"396_CR21","unstructured":"Brown, E., Yuan, B., Johnson, D., Lutz, P.: Covert channels in the HTTP network protocol: channel characterization and detecting man-in-the-middle attacks. In: International Conference on Cyber Warfare and Security, p. 56 (2010)"},{"key":"396_CR22","doi-asserted-by":"publisher","unstructured":"Gianvecchio, S., Wang, H., Wijesekera, D., Jajodia, S.: Model-based covert timing channels: automated modeling and evasion. In: International Workshop on Recent Advances in Intrusion Detection, pp. 211\u2013230 (2008). https:\/\/doi.org\/10.1007\/978-3-540-87403-4_12","DOI":"10.1007\/978-3-540-87403-4_12"},{"key":"396_CR23","doi-asserted-by":"publisher","unstructured":"Coleman, T.P., Kiyavash, N.: Practical codes for queueing channels: an algebraic, state-space, message-passing approach. In: Information Theory Workshop, ITW'08, IEEE, pp. 318\u2013322 (2008). https:\/\/doi.org\/10.1109\/ITW.2008.4578677","DOI":"10.1109\/ITW.2008.4578677"},{"key":"396_CR24","doi-asserted-by":"publisher","unstructured":"Liu, Y., Ghosal, D., Armknecht, F., Sadeghi, A.-R., Schulz, S., Katzenbeisser, S.: Hide and seek in time\u2014robust covert timing channels. In: European Symposium on Research in Computer Security, pp. 120\u2013135 (2009). https:\/\/doi.org\/10.1007\/978-3-642-04444-1_8","DOI":"10.1007\/978-3-642-04444-1_8"},{"key":"396_CR25","doi-asserted-by":"publisher","unstructured":"Liu, Y., Ghosal, D., Armknecht, F., Sadeghi, A.-R., Schulz, S., Katzenbeisser, S.: Robust and undetectable steganographic timing channels for iid traffic. In: International Workshop on Information Hiding, pp. 193--207 (2010). https:\/\/doi.org\/10.1007\/978-3-642-16435-4_15","DOI":"10.1007\/978-3-642-16435-4_15"},{"issue":"3","key":"396_CR26","first-page":"35","volume":"2","author":"M Saadati","year":"2014","unstructured":"Saadati, M., Dehghani, M., Saleh Esfahani, M.: Simulation and evaluation of jitter and packet loss noises influence on covert timing channel performance. J. Electron. Cyber Defence 2(3), 35\u201349 (2014). ((in Persian))","journal-title":"J. Electron. Cyber Defence"},{"key":"396_CR27","doi-asserted-by":"publisher","unstructured":"Liu, J., et al.: A detection-resistant covert timing channel based on geometric huffman coding. In: International Conference on Wireless Algorithms, Systems, and Applications, Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-94268-1_26","DOI":"10.1007\/978-3-319-94268-1_26"},{"key":"396_CR28","doi-asserted-by":"publisher","unstructured":"Archibald, R., Ghosal, D.: A covert timing channel based on fountain codes. In: IEEE 11th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 970\u2013977 (2012). https:\/\/doi.org\/10.1109\/TrustCom.2012.21","DOI":"10.1109\/TrustCom.2012.21"},{"key":"396_CR29","doi-asserted-by":"publisher","unstructured":"Ahn, T.S. et al.: Turbo equalization for covert communication in underwater channel. In: Eighth International Conference on Ubiquitous and Future Networks (ICUFN), IEEE (2016). https:\/\/doi.org\/10.1109\/ICUFN.2016.7537071","DOI":"10.1109\/ICUFN.2016.7537071"},{"key":"396_CR30","doi-asserted-by":"publisher","unstructured":"Wang, J. et al.: Implementing a covert timing channel based on mimic function. In: International Conference on Information Security Practice and Experience, Springer, Cham (2014). https:\/\/doi.org\/10.1007\/978-3-319-06320-1_19","DOI":"10.1007\/978-3-319-06320-1_19"},{"key":"396_CR31","doi-asserted-by":"publisher","DOI":"10.1090\/mmono\/203,PMid:17014848","author":"TS Han","year":"2007","unstructured":"Han, T.S., Kobayashi, K.: Mathematics of information and coding. Am. Math. Soc. (2007). https:\/\/doi.org\/10.1090\/mmono\/203,PMid:17014848","journal-title":"Am. Math. Soc."},{"key":"396_CR32","doi-asserted-by":"publisher","unstructured":"Stillman, R.M.: Detecting IP covert timing channels by correlating packet timing with memory content. In: Southeastcon, IEEE, pp. 204\u2013209 (2008). https:\/\/doi.org\/10.1109\/SECON.2008.4494286","DOI":"10.1109\/SECON.2008.4494286"},{"key":"396_CR33","doi-asserted-by":"publisher","unstructured":"Liu,G., Zhai, J., Dai, Y., Wang, Z.: Covert timing channel with distribution matching. In: International Conference on Multimedia Information Networking and Security, MINES'09, vol.1, pp. 565\u2013568 (2009). https:\/\/doi.org\/10.1109\/MINES.2009.28","DOI":"10.1109\/MINES.2009.28"},{"issue":"2","key":"396_CR34","doi-asserted-by":"publisher","first-page":"199","DOI":"10.1007\/s11235-010-9368-1","volume":"49","author":"G Liu","year":"2012","unstructured":"Liu, G., Zhai, J., Dai, Y.: Network covert timing channel with distribution matching. Telecommun. Syst. 49(2), 199\u2013205 (2012). https:\/\/doi.org\/10.1007\/s11235-010-9368-1","journal-title":"Telecommun. Syst."},{"key":"396_CR35","doi-asserted-by":"publisher","first-page":"458","DOI":"10.1007\/978-3-642-20757-0_36","volume":"2011","author":"S Zander","year":"2011","unstructured":"Zander, S., Armitage, G., Branch, P.: Stealthier inter-packet timing covert channels. Networking 2011, 458\u2013470 (2011). https:\/\/doi.org\/10.1007\/978-3-642-20757-0_36","journal-title":"Networking"},{"issue":"6","key":"396_CR36","doi-asserted-by":"publisher","first-page":"1217","DOI":"10.1016\/j.comnet.2010.11.007","volume":"55","author":"RJ Walls","year":"2011","unstructured":"Walls, R.J., Kothari, K., Wright, M.: Liquid: a detection-resistant covert timing channel based on IPD shaping. Comput. Netw. 55(6), 1217\u20131228 (2011). https:\/\/doi.org\/10.1016\/j.comnet.2010.11.007","journal-title":"Comput. Netw."},{"key":"396_CR37","unstructured":"Lee, K.S., Wang, H., Weatherspoon, H.:{PHY} covert channels: can you see the idles? In: 11th {USENIX} Symposium on Networked Systems Design and Implementation ({NSDI} 14), pp. 173\u2013185 (2014)"}],"container-title":["Journal of Computer Virology and Hacking Techniques"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11416-021-00396-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11416-021-00396-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11416-021-00396-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,14]],"date-time":"2022-05-14T07:07:01Z","timestamp":1652512021000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11416-021-00396-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,8,21]]},"references-count":37,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2022,6]]}},"alternative-id":["396"],"URL":"https:\/\/doi.org\/10.1007\/s11416-021-00396-w","relation":{},"ISSN":["2263-8733"],"issn-type":[{"value":"2263-8733","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,8,21]]},"assertion":[{"value":"27 October 2020","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"7 August 2021","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 August 2021","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}